cheat-engine-bypass

bypass.ps1

Clear-Host
$executable = "cheatengine-x86_64.exe"

function Get-RandomString([int]$Length = 16) {
    $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    $rng = New-Object System.Security.Cryptography.RNGCryptoServiceProvider
    $bytes = New-Object byte[] $Length
    $rng.GetBytes($bytes)
    $result = -join ($bytes | % {$chars[$_ % $chars.Length]})
    $rng.Dispose()
    return $result
}

$orig_path = Join-Path (Get-Location) $executable
if (!(Test-Path $orig_path)) { Write-Output "'$executable' not found"; exit }

$new_filename = "$(Get-RandomString).exe"
$path = Join-Path (Get-Location).Path $new_filename

$strings = @(
    "Cheat Engine", "CheatEngine", "cheatengine", "www.cheatengine.com"
) | % { @{
    original = [System.Text.Encoding]::UTF8.GetBytes($_)
    replacement = [System.Text.Encoding]::UTF8.GetBytes((Get-RandomString -Length $([System.Text.Encoding]::UTF8.GetBytes($_)).Length))
}}

Write-Output "modifying cheat engine, please wait.."

$bytes = [System.IO.File]::ReadAllBytes($orig_path)

#
# randomize strings
#
foreach($pair in $strings){
    $orig = $pair.original
    $rep = $pair.replacement

    for($i = 0; $i -le $bytes.Length - $orig.Length; $i++){
        $match = $true
        for($j = 0; $j -lt $orig.Length; $j++){
            if ($bytes[$i + $j] -ne $orig[$j]) {
                $match = $false
                break
            }
        }
        if($match){
            for($j = 0; $j -lt $rep.Length; $j++){
                $bytes[$i + $j] = $rep[$j]
            }
        }
    }
}

#
# remove metadata
#
try{
    if ($bytes[0] -ne 0x4D -or $bytes[1] -ne 0x5A) {
        throw "invalid pe"
    }
    
    $pe_offset_bytes = New-Object byte[] 4
    [Array]::Copy($bytes, 0x3C, $pe_offset_bytes, 0, 4)
    $pe_offset = [BitConverter]::ToInt32($pe_offset_bytes, 0)
    
    if ($bytes[$pe_offset] -ne 0x50 -or $bytes[$pe_offset + 1] -ne 0x45) {
        throw "invalid pe"
    }
    
    $section_count_bytes = New-Object byte[] 2
    [Array]::Copy($bytes, $pe_offset + 6, $section_count_bytes, 0, 2)
    $sections_count = [BitConverter]::ToInt16($section_count_bytes, 0)
    
    $optional_header_bytes = New-Object byte[] 2
    [Array]::Copy($bytes, $pe_offset + 20, $optional_header_bytes, 0, 2)
    $optional_header_size = [BitConverter]::ToInt16($optional_header_bytes, 0)
    
    $section_offset = $pe_offset + 24 + $optional_header_size
    
    for($i = 0; $i -lt $sections_count; $i++){
        if([Text.Encoding]::ASCII.GetString($bytes, $section_offset + ($i * 40), 8).Trim([char]0) -eq ".rsrc"){
            $rsrc_offset_bytes = New-Object byte[] 4
            [Array]::Copy($bytes, $section_offset + ($i * 40) + 20, $rsrc_offset_bytes, 0, 4)
            $rsrc_offset = [BitConverter]::ToInt32($rsrc_offset_bytes, 0)
            
            $entries_bytes = New-Object byte[] 4
            
            [Array]::Copy($bytes, $rsrc_offset + 12, $entries_bytes, 0, 4)
            
            $entries_count = [BitConverter]::ToInt16($entries_bytes, 0) + [BitConverter]::ToInt16($entries_bytes, 2)
            
            $entry_offset = $rsrc_offset + 16
            
            for($j = 0; $j -lt $entries_count; $j++) {
                $type_bytes = New-Object byte[] 4
                [Array]::Copy($bytes, $entry_offset, $type_bytes, 0, 4)
                $type_id = [BitConverter]::ToInt32($type_bytes, 0)
                
                if($type_id -eq 16){
					
                    for($k = 0; $k -lt 8; $k++){
                        $bytes[$entry_offset + $k] = 0
                    }
                }
                $entry_offset += 8
            }
            break
        }
    }
}catch {Write-Error $_}

[System.IO.File]::WriteAllBytes($path, $bytes)

Write-Output "ok"